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REMARKS 

Claims 14, 25, 26, 27 and 29 have been amended. Applicants reserve the right 
to pursue the original claims and other claims in this application and other applications. 
Claims 12-15, 18-27, 29-32, 42 and 43 are pending in this application. 

The specification stands objected to as failing to provide proper antecedent basis 
for the claimed subject matter with respect to claim 25. Claims 25-27, 29-32 and 43 
stand rejected under 35 U.S.C. §112, first paragraph, as failing to comply with the 
written description requirement. The Office Action contends that the claims contain 
subject matter which was not described in the specification in such a way as to 
reasonably convey to one skilled in the relevant art that the inventor, at the time the 
application was filed, has possession of the claimed invention. Applicants respectfully 
disagree. 

Independent claim 25 is directed to a data center to process usage data that 
comprises "an interface circuit for receiving a first audit record, a second audit record 
and usage data from the value dispensing device," (see Fig. 1, item 48 and 
corresponding description in paragraph [0018]); "the first audit record generated by a 
value dispensing device at a start of an audit period, the first audit record including a 
value of at least one register maintained by the value dispensing device at the start of 
the audit period and a first digital signature, the second audit record generated by the 
value dispensing device at an end of the audit period, the second audit record including 
a value of the at least one register at the end of the audit period and a second digital 
signature;" (see Fig. 2, items 52 and 60 and corresponding description in paragraphs 
[0019] and [0021]); "and means for processing the first audit record, the second audit 
record and the usage data coupled to the interface circuit" (See Fig. 1, item 44 and 
corresponding description in paragraphs [0018]-[0025]); "the processing including 
verifying the first and second digital signatures;" (see corresponding description in 
paragraph [0022]), "determining a difference between the value of the at least one 
register at the end of the audit period and the start of the audit period if the first and 
second digital signatures verify;" (see corresponding description in paragraph [0024]); 
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"comparing the determined difference with corresponding data provide in the usage 
data;" (see corresponding description in paragraph [0024]) and "generating a usage 
report for the value dispensing device based on the usage data if the determined 
difference correlates with the corresponding data provided in the usage data." (see 
corresponding description in paragraphs [0024] and [0025]). 

As expressly detailed above, the specification clearly provides a basis for the 
claimed subject matter, which is described in the specification in such a way as to 
reasonably convey to one skilled in the relevant art that the inventor, at the time the 
application was filed, had possession of the claimed invention. 

Claim 25 was objected to because of a typographical error. Claims 25 has been 
amended to correct the error. 

Claims 14 and 27 stand objected to as being of improper dependent form for 
failing to further limit the subject matter of a previous claim. Reconsideration is 
respectfully requested. Claim 14 is dependent upon claim 13. Claim 13 recites "the first 
and second audit records each include a respective time stamp, and the method further 
comprises: verifying the time stamp in the first audit record corresponds to the start of 
the audit period; and verifying the time stamp in the second audit record corresponds to 
the end of the audit period." Claim 14 as amended recites "The method of claim 13, 
further comprising: indicating an error in the processing of the usage data when one of 
the time stamp in the first audit record or the second audit record does not correspond." 
Thus, claim 14 adds additional limitations to the method of claim 13. Claim 27 similarly 
adds a further limitation to claim 26. Applicants respectfully submit that claims 14 and 
27 are in proper dependent form. 

Claims 25-27, 29-32 and 43 stand rejected under 35 U.S.C. §112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which Applicants regards as the invention. The Office Action further 
contends that the corresponding structure of the means plus function elements cannot 
be determined. Reconsideration is respectfully requested. 
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Claim 25 has been amended such that it does not positively recite the dispensing 
device. 

With respect to the definiteness requirement, the proper test for meeting the 
definiteness requirement is that the corresponding structure of a means-plus-function 
limitation must be disclosed in the specification itself in a way that one skilled in the art 
will understand what structure will perform the recited function. (See Atmel Cop. v. 
Information Storage Devices, Inc., 198 F.3d 1374, 1381, 53 USPQ2d 1225, 1230 9Fed. 
Cir. 1999). As detailed above, the specification is replete with references to the 
corresponding structure (controller 44) is such a way that one skilled in the art will 
understand what structure will perform the recited function. 

The Office Action has also required Applicant to expressly state if the 
corresponding structure of the means-plus-function phrases in claim 25 is software only, 
hardware only, or a combination of hardware and software. As described in the 
specification, the corresponding structure is the controller 44 that performs the algorithm 
described in the flow chart of Fig. 3. 

Claims 12, 18-25, 29-32, 42 and 43 stand rejected under 35 U.S.C. § 102(e) as 
being anticipated by Leon (US 6,424,954). Claims 13-15 stand rejected under 35 
U.S.C. § 103(a) as being unpatentable over Leon in view of Mosher (US 5,799,322). 
Reconsideration is respectfully requested. 

As noted in the current specification, in many instances it is desirable, or in some 
cases mandated by the postal authority, for value dispensing devices, e.g., postage 
meters, to maintain usage information. Such usage information can include, for 
example, the amount of postage dispensed by the meter, as well as other data, 
including, for example, total mail piece counts, piece counts for different classes of mail, 
piece counts for each different postage amount dispensed, etc. The usage information 
is typically compiled over a predetermined period of time, referred to as an audit period, 
such as, for example, weekly, monthly, or yearly. At the end of the determined audit 
period, the captured data for that audit period is transmitted to a data center, such as, 
for example, a data center operated by the meter manufacturer, where it is used to 
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prepare reports. The prepared reports can be sent to the postal authority. These 
reports may then be utilized by the postal authorities (or the meter manufacturer) for 
such things, for example, as statistical analysis of use of the meter population, customer 
billing, etc. 

There are problems, however, with conventional systems and methods for 
preparing data capture reports for a given audit period. One such problem is that the 
data capture data is blindly trusted for preparation of a report. The data capture data, 
however, may not be fully trustworthy when received from the postage meter. For 
example, since the usage information is not securely stored within the device, it is 
possible for a dishonest person to modify the data capture data before it is transmitted 
to the meter manufacturer. For example, the value of the total amount of postage 
dispensed during the audit period could be modified in such a way that this value is 
made lower than the actual value used. In cases where the reports are used for billing 
purposes, the postal authority would under bill the customer, based on the modified 
data capture report, and thus the postal authority would be defrauded of funds due. 

The present invention alleviates the problems associated with the prior art and 
provides a system and method that can detect tampering with data capture data, as well 
as verify the authenticity of data capture data, in a value dispensing system. At the 
beginning of an audit period, an audit record is generated by the postage meter that 
includes the current register values at the beginning of the audit period and a digital 
signature generated by the device. At the end of the audit period, a second audit record 
is generated by the postage meter that includes the register values at the end of the 
audit period and a digital signature generated by the device. This end of period audit 
record is then transmitted to the data center, along with the data capture data and the 
start of period audit record (if not previously transmitted to the data center). The data 
center, after obtaining both the end of period audit record and start of period audit 
record, will verify the digital signature of the both audit records. Successful verification 
of the digital signatures authenticates the device to the data center, and indicates that 
the register values are valid, as any modification of the data contained within the audit 
records would result in a failure of the signature verification. The data center can then 
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reconcile the postage meter usage, i.e., register values, by comparing the difference 
between the register values from the start of period audit record and the end of period 
audit record with the values as contained within the data capture data for the audit 
period. Any discrepancies between these values indicate that the data capture data 
may not be correct, and a further investigation can be performed. If there are no 
discrepancies, the data capture data is deemed to be accurate and the data can be 
utilized to prepare reports with a high degree of certainty that it accurately reflects the 
actual usage of the postage meter. (See Specification, paragraphs [0022] through 
[0025]). 

In view of the above, claim 12 is directed to a method for a data center to 
process usage data of a value dispensing device that comprises "receiving a first audit 
record from the value dispensing device, the first audit record generated by the value 
dispensing device at a start of an audit period, the first audit record including a value of 
at least one register maintained by the value dispensing device at the start of the audit 
period and a first digital signature; receiving a second audit record from the value 
dispensing device, the second audit record generated by the value dispensing device at 
an end of the audit period, the second audit record including a value of the at least one 
register maintained by the value dispensing device at the end of the audit period and a 
second digital signature; receiving usage data from the value dispensing device for the 
audit period; verifying the first and second digital signatures; if the first and second 
digital signatures verify, determining a difference between the value of the at least one 
register at the end of the audit period and the start of the audit period; comparing the 
determined difference with corresponding data provided in the usage data; and if the 
determined difference correlates with the corresponding data provided in the usage 
data, generating a usage report for the value dispensing system based on the usage 
data." 

Leon, in contrast is directed to a postage metering system in which an audit 
transaction is performed periodically to reset a timer. If the timer times out before an 
audit transaction is performed, the secure metering device (SMD) transitions to a state 
in which no further operation (except for an audit transaction) is permitted. A user 
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requests an audit causing the host PC to send an audit request message to the SMD. 
The SMD then sends the host PC a signed message that includes the required 
information, which can include the current contents of the secure revenue registers, the 
device ID number, the current date and time, and a transaction serial number generated 
by the SMD. The host PC forwards the signed message to a system server, which 
receives and validates the message. As part of the processing, the system server 
authenticates the signed message using the SMD's public key and analyzes the data 
included in the message. The system server then sends the host PC a signed message 
that includes the response data, including the same device ID and transaction number 
from the message received earlier. The host PC forwards this signed message to the 
SMD, which validates the message by verifying the signature and determining if the 
message is of an expected type. If the signature is valid and the message is of an 
expected typed, the SMD determines if the data contents of the message is correct by 
verifying the transaction serial number. If the data is valid, the SMD resets the timer 
and transitions to an operating state. (Col. 18, line 30 to Col. 19, Iine15). 

Thus, in Leon the system uses only a single audit record for the purpose of 
resetting a timer. There is no disclosure, teaching or suggestion in Leon of "receiving a 
second audit record from the value dispensing device, the second audit record 
generated by the value dispensing device at an end of the audit period, the second 
audit record including a value of the at least one register maintained by the value 
dispensing device at the end of the audit period and a second digital signature" as is 
recited in claim 12. In Leon, there is no second audit record generated at the end of an 
audit period. The system in Leon uses only a single audit record taken at a specific 
point in time. The Office Action appears to be contending that the audit requests in 
Leon sent at the end of one period are also considered to be sent at the beginning of a 
subsequent period, and therefore this single audit request in Leon is the same as a first 
audit record generated at the start of an audit period and a second audit record 
generated at the end of the audit period. It is unclear how a single audit request in Leon 
is analogous to a first audit report and a second audit report that are generated at 
different times. There is no disclosure, teaching or suggestion in Leon of "receiving a 
first audit record from the value dispensing device, the first audit record generated by 
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the value dispensing device at a start of an audit period, the first audit record including a 
value of at least one register maintained by the value dispensing device at the start of 
the audit period and a first digital signature; receiving a second audit record from the 
value dispensing device, the second audit record generated by the value dispensing 
device at an end of the audit period, the second audit record including a value of the at 
least one register maintained by the value dispensing device at the end of the audit 
period and a second digital signature" as is recited in claim 12. 

There is also no disclosure, teaching or suggestion in Leon of "receiving usage 
data from the value dispensing device for the audit period." While the messages in 
Leon may provide current information, there is nothing in Leon that describes any type 
of usage data for an audit period. The Office Action has not provided any indication as 
to where this feature is allegedly disclosed, taught or suggested in Leon. 

There is also no disclosure, teaching or suggestion in Leon of "determining a 
difference between the value of the at least one register at the end of the audit period 
and the start of the audit period." The Office Action contends that Col. 61, line 51 to 
Col. 62, line 13 of Leon disclose this feature. Col. 61 describes a message, processed 
during a funding transaction, which instructs the SMD to increase the value in the 
descending register, thereby increasing the SMD's revenue store. The message 
includes a type code that identifies the FUND3 message, followed by a Postage Value 
Download field that was sent to the host PC by the system server. The Postage Value 
Download field includes the device identification, a serial number identifying the 
particular secure transaction, a control total (ascending register plus descending 
register) and the value by which the descending register will be increased. Upon receipt 
of the FUND3 message, the SMD pads the PVD field as necessary under FIPS-180, 
and verifies the digital signature. If the signature is valid, the SMD checks the 
Transaction ID included in the PVD field against the Transaction ID included in the 
FUND2 message. If the IDs are not equal, the SMD responds by sending the host PC 
an ERROR message that includes an error code of TRANSJD and returning to the 
operating state it occupied at the start of the Funding transaction. If the Transaction IDs 
are equal, the SMD compares the value included in the Control Total with the sum of 
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the SMD's current Ascending and Descending registers plus the value included in the 
Funding Revenue field of the message. If the Control Total included in the message is 
not equal to the sum, the SMD has already processed this funding transaction or is in 
some other way unsynchronized with the system server, and does not update the 
Descending register. The SMD sends the host PC an ERROR message that includes a 
CONTROL error number and then transitions to the Registered state. If the Control 
Total is equal to the sum, the SMD increases the value of the internally stored 
Descending register, and prepares and sends a FUND4 message to the host PC. The 
SMD also records the Funding Revenue amount and the date and time of this Funding 
transaction, so it can report it as the previous values in the next Funding transaction. 
(Col. 61, line 5 to Col. 62, line 44). Nowhere in the passages relied upon by the Office 
Action is there any disclosure, teaching or suggestion of determining a difference 
between the value of the at least one register at the end of the audit period and the start 
of the audit period. The funding transaction in Leon is not in any way related to any 
type of audit period, nor is it related to the audit transaction previously discussed. There 
are no first or second audit records generated at the start and end of an audit period, 
and there is no determination of a difference between the value of a register at the end 
of the audit period and the start of the audit period. 

There is also no disclosure, teaching or suggestion in Leon of "comparing the 
determined difference with corresponding data provided in the usage data" as is recited 
in claim 12. The Office Action contends that Col. 62, lines 4-13 disclose this feature. In 
Leon, the SMD compares the value included in the Control Total of the FUND3 
message with the sum of the SMD's current Ascending register and Descending 
registers plus the value included in the Funding Revenue field of the message. None of 
the values being compared in Leon are a determined difference (of the value of a 
register at the end of the audit period and the start of the audit period) or any type of 
corresponding data provided in the usage data. 

There is also no disclosure, teaching or suggestion in Leon of generating a 
usage report for the value dispensing system based on the usage data if the determined 
difference correlates with the corresponding data provided in the usage data as is 
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recited in claim 12. The Office Action contends that Col. 62, lines 14-43 disclose this 
feature. As stated in Col. 62, lines 14-43, of Leon, if the Control Total is equal to the 
sum, the SMD increases the value of the internally stored Descending register, and 
prepares and sends a FUND4 message to the host PC. The SMD also records the 
Funding Revenue amount and the date and time of this Funding transaction, so it can 
report it as the previous values in the next Funding transaction. Increasing the value of 
the descending register is not the same as generating a usage report based on usage 
data. Furthermore, the FUND4 message is not a usage report - it merely is a status 
message to indicate the status of the postage download. 

For at least the above reasons, Applicants respectfully submit that claim 12 is 
allowable over the prior art of record. Claims 13-15, 18-24 and 42, dependent upon 
claim 12, are allowable along with claim 12 and on their own merits. 

Claim 25 as amended includes limitations similar to those of claim 12. For the 
same reasons given above with respect to claim 12, Applicants respectfully submit that 
claim 25 is allowable over the prior art of record. Claims 26, 27, 29-32 and 43, 
dependent upon claim 25, are allowable along with claim 25 and on their own merits. 

In view of the foregoing amendments and remarks, it is respectfully submitted 
that the claims of this case are in a condition for allowance and favorable action thereon 
is requested. 

Respectfully submitted, 

/Brian A. Lemm/ 
Brian A. Lemm 
Reg. No. 43,748 
Attorney for Applicants 
Telephone (203) 924-3836 
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